Agency Rules Could Undermine CUI Reforms

A proposed Department of Defense (DOD) rule has the open government community concerned that agencies may try to undermine the Obama administration's emerging controlled unclassified information (CUI) system before it is even formally in place.

Background

In November 2010, President Obama signed a new executive order on CUI, reforming the system of safeguarding information that is not classified but is still considered "sensitive." The new system allows agencies to "safeguard" information only where justified by law, regulation, or government-wide policy.

Previously, agencies had established methods for controlling unclassified information on an ad hoc basis, without standards or oversight. The result was an opaque and confusing jumble of practices, which stymied public access and inhibited information sharing – even between federal agencies.

Under the executive order, agencies can only use CUI categories that have been approved by the National Archives and Records Administration (NARA) and listed in a public registry. The order gives NARA some authority to amend and combine CUI categories to create consistency across agencies. However, the order also states that NARA cannot reject categories with a solid basis in law, regulation, or government-wide policy.

Open government advocates had hoped that requiring a justification in law, regulation, or government-wide policy would limit the kinds of information that could be categorized as CUI and thus withheld from public scrutiny. However, if agencies adopt regulations that create new loopholes, it is unclear if NARA would have the authority to deny or modify the category. If every agency proposes regulations that create overly broad and vague CUI categories, the chaos of the earlier system would be recreated.

Proposed Rule

On June 29, DOD proposed a rule that would purportedly institute new requirements for defense contractors to safeguard the extremely broad category of "Unclassified DOD Information," consisting of all unclassified information that has not been made public or received approval to be disclosed to the public.

DOD published an advance notice of the proposed rule in March 2010, before the new executive order was issued. Though the executive order dramatically changes the framework for CUI, the proposed DOD rule has not substantially changed.

The proposed DOD rule would establish basic safeguarding responsibilities for any "nonpublic information," that is, any information that has not been publicly released. However, in comments on the advance notice, contractors noted that such an approach is problematic because they would have no way of knowing whether particular information had been cleared for public release.

This uncertainty could easily result in a presumption of control, causing nearly all DOD information to be treated as de facto CUI. This would contradict the purpose and spirit of President Obama's freedom of information memorandum, which called on agencies to "adopt a presumption in favor of disclosure."

In addition, the proposed rule would require enhanced safeguarding for certain types of information, including notifying DOD of breaches to systems storing such information. Rather than defining the specific information to be controlled, however, the proposed rule simply refers to internal DOD policies.

This would have the effect of enshrining the previous DOD "sensitive but unclassified information" categories that the executive order was supposed to limit and narrow, instead creating a catch-all category. As internal policies, these categories have never been subject to public comment or regulatory review. The proposed rule does not describe the scope or definition of these categories, leaving them poorly understood and impossible for the public to comment on in any significant way.

Information subject to enhanced safeguarding includes categories such as the much-maligned "For Official Use Only (FOUO)," which are so vague as to be meaningless. Again, the uncertainty about what information is subject to such controls would likely cause undue restrictions to be placed on government information, far beyond those authorized by law.

Reactions

Open government advocates are concerned that the proposed rule would restrict public access to information, while defense contractors are concerned about the difficulty of complying with the proposed rule. Scott Amey of the Project On Government Oversight called the proposed rule "an effort to restrict access to public information." Patrice McDermott of OpenTheGovernment.org was concerned the rule would "open a floodgate for other agencies" to seek similar loopholes.

The Federal Times editorialized against the proposed rule, writing, "The Pentagon's proposal needs to be squared more explicitly with Obama's stated goal of government openness. It needs more clarity on what information deserves more control and what should be presumed open to the public."

Steven Aftergood of the Federation of American Scientists wrote that the proposed rule "establishes secrecy, not openness, as the presumptive status and default mode for most unclassified information," which would have "breathtaking implications."

More on the Horizon?

Although the new CUI system instituted by the executive order will not be functional until at least November, agencies have continued to propose revisions to existing CUI policies and information categories that could restrict rather than open up information.

The FAR Council, which manages the Federal Acquisition Regulation dictating government-wide procurement policy, on July 1 submitted a proposed rule on Basic Safeguarding of Unclassified Government Information Within Contractor Information Systems to the Office of Management and Budget (OMB). The full proposal is not available for public review until OMB approves it, at which point the proposed rule will be published in the Federal Register for public comment.

DOD has also announced its intent to further revise its CUI policies. According to the Unified Agenda published on July 7, the Defense Contract Audit Agency intends to publish a proposed rule in July revising its FOUO policies.

Open government advocates are waiting to see whether the White House will intervene and direct DOD to withdraw or narrow its proposed rule in order to preserve the intent of the executive order.

back to Blog